Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 109

Export CSV
CVE-2020-27813

golang-github-gorilla-websocket: integer overflow leads to denial of service

An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. An attacker would use this flaw to cause a denial of service attack on an HTTP Server allowing websocket connections.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Debian Gorillatoolkit Redhat
Products
Debian Linux Websocket Container Native Virtualization and 1 more
CVE-2020-26160

jwt-go: access restriction bypass vulnerability

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Jwt-go Project Redhat
Products
Jwt-go Container Native Virtualization Cryostat and 3 more
CVE-2020-1742

nmstate/kubernetes-nmstate-handler: /etc/passwd is given incorrect privileges

An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Versions before kubernetes-nmstate-handler-container-v2.3.0-30 are affected.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Nmstate Redhat
Products
Kubernetes-nmstate Container Native Virtualization Openshift Virtualization
CVE-2020-1701

virt-handler: virt-handler daemonset clusterroles allows retrieval of secrets

A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create VMs could attach any secret within their namespace, allowing them to read the contents of that secret.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Kubevirt Redhat
Products
Kubevirt Container Native Virtualization
CVE-2020-16845

golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

CVSS 3.1 · 7.5 High EPSS 4.9% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 2 more
Products
Debian Linux Fedora Go and 10 more
CVE-2020-15586

golang: data race in certain net/http servers including ReverseProxy can lead to DoS

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

CVSS 3.1 · 5.9 Medium EPSS 2.9% KEV · Not listed
Vendors
Cloudfoundry Debian Fedoraproject and 3 more
Products
Cf-deployment Routing-release Debian Linux and 12 more
CVE-2020-14316

kubevirt: VMIs can be used to access host files

A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any file on the system where the VMI is running. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 9.9 Critical EPSS 1.6% KEV · Not listed
Vendors
Kubevirt Redhat
Products
Kubevirt Container Native Virtualization Openshift Virtualization
CVE-2020-14040

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Text 3scale Amp and 13 more
CVE-2020-10749

containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters

A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.

CVSS 3.1 · 6 Medium EPSS 2.1% KEV · Not listed
Vendors
Fedoraproject Linuxfoundation Redhat
Products
Fedora Cni Network Plugins Container Native Virtualization and 4 more